Gna
/
website
2
0
Fork 0
Code Issues 1 Pull Requests Projects Releases Wiki Activity

new deploy: 2022-10-17T09:10:37+00:00

pages
Loïc Dachary 2022-10-17 09:10:37 +00:00 committed by dachary
parent f9a78e3d94
commit bb6220428d
9 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
blog/1-17-3-git-security/index.html
View File

@ -230,7 +230,7 @@
<p>When displaying the commit graph <a href="https://gitea.gna.org/Gna/organization/graph?branch=refs%2Fheads%2Fmaster">for the master branch</a>, the URL contains the argument <strong>refs%2Fheads%2Fmaster</strong> that is passed to the <code>git</code> command with something like:</p>
<pre data-lang="shell" style="background-color:#2b303b;color:#c0c5ce;" class="language-shell "><code class="language-shell" data-lang="shell"><span>git log --graph refs/head/master
</span></code></pre>
<p>If, by accident or maliciously, the branch name with a dash, it would be mistaken to be a <code>git</code> argument instead of a branch name. For instance <strong>-h</strong> could be passed to the <code>git</code> command as:</p>
<p>If, by accident or maliciously, the branch name starts with a dash, it would be mistaken to be a <code>git</code> argument instead of a branch name. For instance <strong>-h</strong> could be passed to the <code>git</code> command as:</p>
<pre data-lang="shell" style="background-color:#2b303b;color:#c0c5ce;" class="language-shell "><code class="language-shell" data-lang="shell"><span>git log --graph -h
</span></code></pre>
<p>In reality the <code>rev-list</code> command is called before <code>log</code> and in Gitea 1.17.2 the debug output will show something like:</p>

2
blog/atom.xml
View File

@ -16,7 +16,7 @@
&lt;p&gt;When displaying the commit graph &lt;a href=&quot;https:&#x2F;&#x2F;gitea.gna.org&#x2F;Gna&#x2F;organization&#x2F;graph?branch=refs%2Fheads%2Fmaster&quot;&gt;for the master branch&lt;&#x2F;a&gt;, the URL contains the argument &lt;strong&gt;refs%2Fheads%2Fmaster&lt;&#x2F;strong&gt; that is passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command with something like:&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;shell&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-shell &quot;&gt;&lt;code class=&quot;language-shell&quot; data-lang=&quot;shell&quot;&gt;&lt;span&gt;git log --graph refs&#x2F;head&#x2F;master
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
&lt;p&gt;If, by accident or maliciously, the branch name with a dash, it would be mistaken to be a &lt;code&gt;git&lt;&#x2F;code&gt; argument instead of a branch name. For instance &lt;strong&gt;-h&lt;&#x2F;strong&gt; could be passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command as:&lt;&#x2F;p&gt;
&lt;p&gt;If, by accident or maliciously, the branch name starts with a dash, it would be mistaken to be a &lt;code&gt;git&lt;&#x2F;code&gt; argument instead of a branch name. For instance &lt;strong&gt;-h&lt;&#x2F;strong&gt; could be passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command as:&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;shell&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-shell &quot;&gt;&lt;code class=&quot;language-shell&quot; data-lang=&quot;shell&quot;&gt;&lt;span&gt;git log --graph -h
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
&lt;p&gt;In reality the &lt;code&gt;rev-list&lt;&#x2F;code&gt; command is called before &lt;code&gt;log&lt;&#x2F;code&gt; and in Gitea 1.17.2 the debug output will show something like:&lt;&#x2F;p&gt;

2
search_index.en.js
View File

File diff suppressed because one or more lines are too long

2
tags/gitea/atom.xml
View File

@ -16,7 +16,7 @@
&lt;p&gt;When displaying the commit graph &lt;a href=&quot;https:&#x2F;&#x2F;gitea.gna.org&#x2F;Gna&#x2F;organization&#x2F;graph?branch=refs%2Fheads%2Fmaster&quot;&gt;for the master branch&lt;&#x2F;a&gt;, the URL contains the argument &lt;strong&gt;refs%2Fheads%2Fmaster&lt;&#x2F;strong&gt; that is passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command with something like:&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;shell&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-shell &quot;&gt;&lt;code class=&quot;language-shell&quot; data-lang=&quot;shell&quot;&gt;&lt;span&gt;git log --graph refs&#x2F;head&#x2F;master
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
&lt;p&gt;If, by accident or maliciously, the branch name with a dash, it would be mistaken to be a &lt;code&gt;git&lt;&#x2F;code&gt; argument instead of a branch name. For instance &lt;strong&gt;-h&lt;&#x2F;strong&gt; could be passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command as:&lt;&#x2F;p&gt;
&lt;p&gt;If, by accident or maliciously, the branch name starts with a dash, it would be mistaken to be a &lt;code&gt;git&lt;&#x2F;code&gt; argument instead of a branch name. For instance &lt;strong&gt;-h&lt;&#x2F;strong&gt; could be passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command as:&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;shell&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-shell &quot;&gt;&lt;code class=&quot;language-shell&quot; data-lang=&quot;shell&quot;&gt;&lt;span&gt;git log --graph -h
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
&lt;p&gt;In reality the &lt;code&gt;rev-list&lt;&#x2F;code&gt; command is called before &lt;code&gt;log&lt;&#x2F;code&gt; and in Gitea 1.17.2 the debug output will show something like:&lt;&#x2F;p&gt;

2
tags/gna/atom.xml
View File

@ -16,7 +16,7 @@
&lt;p&gt;When displaying the commit graph &lt;a href=&quot;https:&#x2F;&#x2F;gitea.gna.org&#x2F;Gna&#x2F;organization&#x2F;graph?branch=refs%2Fheads%2Fmaster&quot;&gt;for the master branch&lt;&#x2F;a&gt;, the URL contains the argument &lt;strong&gt;refs%2Fheads%2Fmaster&lt;&#x2F;strong&gt; that is passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command with something like:&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;shell&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-shell &quot;&gt;&lt;code class=&quot;language-shell&quot; data-lang=&quot;shell&quot;&gt;&lt;span&gt;git log --graph refs&#x2F;head&#x2F;master
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
&lt;p&gt;If, by accident or maliciously, the branch name with a dash, it would be mistaken to be a &lt;code&gt;git&lt;&#x2F;code&gt; argument instead of a branch name. For instance &lt;strong&gt;-h&lt;&#x2F;strong&gt; could be passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command as:&lt;&#x2F;p&gt;
&lt;p&gt;If, by accident or maliciously, the branch name starts with a dash, it would be mistaken to be a &lt;code&gt;git&lt;&#x2F;code&gt; argument instead of a branch name. For instance &lt;strong&gt;-h&lt;&#x2F;strong&gt; could be passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command as:&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;shell&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-shell &quot;&gt;&lt;code class=&quot;language-shell&quot; data-lang=&quot;shell&quot;&gt;&lt;span&gt;git log --graph -h
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
&lt;p&gt;In reality the &lt;code&gt;rev-list&lt;&#x2F;code&gt; command is called before &lt;code&gt;log&lt;&#x2F;code&gt; and in Gitea 1.17.2 the debug output will show something like:&lt;&#x2F;p&gt;

2
tags/problem/atom.xml
View File

@ -16,7 +16,7 @@
&lt;p&gt;When displaying the commit graph &lt;a href=&quot;https:&#x2F;&#x2F;gitea.gna.org&#x2F;Gna&#x2F;organization&#x2F;graph?branch=refs%2Fheads%2Fmaster&quot;&gt;for the master branch&lt;&#x2F;a&gt;, the URL contains the argument &lt;strong&gt;refs%2Fheads%2Fmaster&lt;&#x2F;strong&gt; that is passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command with something like:&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;shell&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-shell &quot;&gt;&lt;code class=&quot;language-shell&quot; data-lang=&quot;shell&quot;&gt;&lt;span&gt;git log --graph refs&#x2F;head&#x2F;master
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
&lt;p&gt;If, by accident or maliciously, the branch name with a dash, it would be mistaken to be a &lt;code&gt;git&lt;&#x2F;code&gt; argument instead of a branch name. For instance &lt;strong&gt;-h&lt;&#x2F;strong&gt; could be passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command as:&lt;&#x2F;p&gt;
&lt;p&gt;If, by accident or maliciously, the branch name starts with a dash, it would be mistaken to be a &lt;code&gt;git&lt;&#x2F;code&gt; argument instead of a branch name. For instance &lt;strong&gt;-h&lt;&#x2F;strong&gt; could be passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command as:&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;shell&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-shell &quot;&gt;&lt;code class=&quot;language-shell&quot; data-lang=&quot;shell&quot;&gt;&lt;span&gt;git log --graph -h
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
&lt;p&gt;In reality the &lt;code&gt;rev-list&lt;&#x2F;code&gt; command is called before &lt;code&gt;log&lt;&#x2F;code&gt; and in Gitea 1.17.2 the debug output will show something like:&lt;&#x2F;p&gt;

2
tags/security/atom.xml
View File

@ -16,7 +16,7 @@
&lt;p&gt;When displaying the commit graph &lt;a href=&quot;https:&#x2F;&#x2F;gitea.gna.org&#x2F;Gna&#x2F;organization&#x2F;graph?branch=refs%2Fheads%2Fmaster&quot;&gt;for the master branch&lt;&#x2F;a&gt;, the URL contains the argument &lt;strong&gt;refs%2Fheads%2Fmaster&lt;&#x2F;strong&gt; that is passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command with something like:&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;shell&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-shell &quot;&gt;&lt;code class=&quot;language-shell&quot; data-lang=&quot;shell&quot;&gt;&lt;span&gt;git log --graph refs&#x2F;head&#x2F;master
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
&lt;p&gt;If, by accident or maliciously, the branch name with a dash, it would be mistaken to be a &lt;code&gt;git&lt;&#x2F;code&gt; argument instead of a branch name. For instance &lt;strong&gt;-h&lt;&#x2F;strong&gt; could be passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command as:&lt;&#x2F;p&gt;
&lt;p&gt;If, by accident or maliciously, the branch name starts with a dash, it would be mistaken to be a &lt;code&gt;git&lt;&#x2F;code&gt; argument instead of a branch name. For instance &lt;strong&gt;-h&lt;&#x2F;strong&gt; could be passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command as:&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;shell&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-shell &quot;&gt;&lt;code class=&quot;language-shell&quot; data-lang=&quot;shell&quot;&gt;&lt;span&gt;git log --graph -h
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
&lt;p&gt;In reality the &lt;code&gt;rev-list&lt;&#x2F;code&gt; command is called before &lt;code&gt;log&lt;&#x2F;code&gt; and in Gitea 1.17.2 the debug output will show something like:&lt;&#x2F;p&gt;

2
tags/solution/atom.xml
View File

@ -16,7 +16,7 @@
&lt;p&gt;When displaying the commit graph &lt;a href=&quot;https:&#x2F;&#x2F;gitea.gna.org&#x2F;Gna&#x2F;organization&#x2F;graph?branch=refs%2Fheads%2Fmaster&quot;&gt;for the master branch&lt;&#x2F;a&gt;, the URL contains the argument &lt;strong&gt;refs%2Fheads%2Fmaster&lt;&#x2F;strong&gt; that is passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command with something like:&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;shell&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-shell &quot;&gt;&lt;code class=&quot;language-shell&quot; data-lang=&quot;shell&quot;&gt;&lt;span&gt;git log --graph refs&#x2F;head&#x2F;master
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
&lt;p&gt;If, by accident or maliciously, the branch name with a dash, it would be mistaken to be a &lt;code&gt;git&lt;&#x2F;code&gt; argument instead of a branch name. For instance &lt;strong&gt;-h&lt;&#x2F;strong&gt; could be passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command as:&lt;&#x2F;p&gt;
&lt;p&gt;If, by accident or maliciously, the branch name starts with a dash, it would be mistaken to be a &lt;code&gt;git&lt;&#x2F;code&gt; argument instead of a branch name. For instance &lt;strong&gt;-h&lt;&#x2F;strong&gt; could be passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command as:&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;shell&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-shell &quot;&gt;&lt;code class=&quot;language-shell&quot; data-lang=&quot;shell&quot;&gt;&lt;span&gt;git log --graph -h
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
&lt;p&gt;In reality the &lt;code&gt;rev-list&lt;&#x2F;code&gt; command is called before &lt;code&gt;log&lt;&#x2F;code&gt; and in Gitea 1.17.2 the debug output will show something like:&lt;&#x2F;p&gt;

2
tags/upgrade/atom.xml
View File

@ -16,7 +16,7 @@
&lt;p&gt;When displaying the commit graph &lt;a href=&quot;https:&#x2F;&#x2F;gitea.gna.org&#x2F;Gna&#x2F;organization&#x2F;graph?branch=refs%2Fheads%2Fmaster&quot;&gt;for the master branch&lt;&#x2F;a&gt;, the URL contains the argument &lt;strong&gt;refs%2Fheads%2Fmaster&lt;&#x2F;strong&gt; that is passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command with something like:&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;shell&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-shell &quot;&gt;&lt;code class=&quot;language-shell&quot; data-lang=&quot;shell&quot;&gt;&lt;span&gt;git log --graph refs&#x2F;head&#x2F;master
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
&lt;p&gt;If, by accident or maliciously, the branch name with a dash, it would be mistaken to be a &lt;code&gt;git&lt;&#x2F;code&gt; argument instead of a branch name. For instance &lt;strong&gt;-h&lt;&#x2F;strong&gt; could be passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command as:&lt;&#x2F;p&gt;
&lt;p&gt;If, by accident or maliciously, the branch name starts with a dash, it would be mistaken to be a &lt;code&gt;git&lt;&#x2F;code&gt; argument instead of a branch name. For instance &lt;strong&gt;-h&lt;&#x2F;strong&gt; could be passed to the &lt;code&gt;git&lt;&#x2F;code&gt; command as:&lt;&#x2F;p&gt;
&lt;pre data-lang=&quot;shell&quot; style=&quot;background-color:#2b303b;color:#c0c5ce;&quot; class=&quot;language-shell &quot;&gt;&lt;code class=&quot;language-shell&quot; data-lang=&quot;shell&quot;&gt;&lt;span&gt;git log --graph -h
&lt;&#x2F;span&gt;&lt;&#x2F;code&gt;&lt;&#x2F;pre&gt;
&lt;p&gt;In reality the &lt;code&gt;rev-list&lt;&#x2F;code&gt; command is called before &lt;code&gt;log&lt;&#x2F;code&gt; and in Gitea 1.17.2 the debug output will show something like:&lt;&#x2F;p&gt;